On December 12th, the CFPB proposed to establish a registration system to catalog regulatory actions involving non-bank providers of consumer financial products and services brought by federal and state regulators. The proposal applies to all non-bank providers subject to the CFPB's jurisdiction. The proposal would also require certain non-banks who are supervised by the Bureau to provide an annual attestation of compliance with orders filed against their company. The Bureau is also considering publishing on its website some or all the data collected pursuant to the rule. The proposal would exclude depository institutions, credit unions, and service providers that do not themselves directly offer financial products to consumers. The proposal will be open for public comment for 60 days after it is published in the Federal Register.
CFPB's Justification for the Proposed Registration System
The Bureau goes to great lengths to explain why it proposed this rule. Its reasons include:
- The existence of a public order against a company may be evidence that the company "may pose heightened and ongoing risks to consumers" and the Bureau wants to learn about such risks.[1]
- Monitoring of these orders will allow the Bureau "to track specific instances of, and more general developments regarding, potential corporate recidivism, which presents special risks to consumers."[2]
- More data on enforcement trends would highlight areas posing risk to consumers.
- Knowledge of orders about a specific company will help the Bureau determine how and when to exercise supervisory jurisdiction over the company or its industry.
- Data would be available not only to the Bureau, but to other law enforcement and regulatory agencies as well as consumer advocates, researchers, and the media.
Required Reporting by Nonbank Covered Persons
The CFPB proposes to require non-banks to register the existence of four types of final public orders:
- Orders relating to a violation of a federal consumer finance law (g., TILA, EFTA, and ECOA).
- Orders that involve violations of other laws the CFPB can enforce, such as the Military Lending Act.[3]
- Orders involving violation of section 5 of the FTC Act (which prohibits unfair and deceptive acts and practices).
- Orders involving violation of state laws prohibiting unfair and deceptive conduct.
The Bureau listed all state statutes it believes are covered in these four categories in an appendix to the proposal. It seeks comment on whether its list is complete and whether to also include state laws prohibiting "unconscionable" conduct.[4] The proposed requirement to report a particular order would expire ten years after that order was finalized.
Supervised Entity Annual Written Statement
The proposal would also require certain non-banks supervised by the Bureau to provide an annual written statement regarding each order to which the company is subject. An entity's executive would be required to describe: (i) steps undertaken to review and oversee the entity's activities subject to the order and (ii) whether the entity identified any violations of or non-compliance with a public order.
The Bureau would require the executive signing the attestation to be the entity's "highest-ranking individual charged with managerial or oversight responsibility for the entity whose assigned duties include ensuring the entity’s compliance with Federal consumer financial law."[5] These entities would also have to retain records documenting compliance with the written statement requirement.
Coverage
This is the first substantive CFPB rule that would not apply to a defined set of providers, such as mortgage originators or prepaid account providers. Instead, CFPB proposed to apply the rule to all non-bank providers of consumer financial products and services, as defined by the Dodd-Frank Act. Specifically, the proposal would apply to non-banks in the categories listed below, to the extent they provide services to consumers for personal, family and household purposes:
- Extending credit and servicing loans;
- Extending or brokering certain leases of personal or real property;
- Providing real estate settlement services;
- Engaging in deposit-taking activities, transmitting or exchanging funds, or otherwise acting as a custodian of funds;
- Selling, providing, or issuing stored value or payment instruments;
- Providing check cashing, check collection, or check guaranty services;
- Providing payments or other financial data processing products or services to a consumer by any technological means;
- Providing financial advisory services;
- Collecting, analyzing, maintaining, or providing consumer report information or certain other account information; and
- Collecting debt related to any consumer financial product or service.[6]
The Bureau restated these categories from the Dodd-Frank Act but declined to explain how a company should determine whether it is a provider of one of these consumer financial products or services. In fact, the Bureau addresses which entities are covered by the proposal in a single footnote.[7] Typically, the Bureau's substantive rules go into detail to explain which entities are subject to the rule's requirements. This is particularly important here because coverage under the Dodd-Frank Act is far from simple and the scope of many of these definitions has never been clarified by the Bureau or courts. For example, a covered person includes a person who:
"provid[es] payments or other financial data processing products or services to a consumer by any technological means, including processing or storing financial or banking data for any payment instrument, or through any payments systems or network used for processing payments data, including payments made through an online banking system or mobile telecommunications network" 12 U.S.C. § 5481(15)(vii).
Companies will largely have to determine for themselves whether they are covered by the proposal unless the Bureau issues further clarification. The Bureau does briefly acknowledge this complexity and proposed to allow entities with a good faith belief that they are not covered by one of these definitions to file a statement of non-registration with the Bureau. The Bureau would not pursue an enforcement action over an entity's good faith filing if it disagreed with the entity's determination.
The proposal would also exclude, with some exceptions, covered entities with less than $1 million in annual receipts.
Authority and Next Steps
The Bureau relies on several different authorities to support its proposal. The Dodd-Frank Act granted the Bureau authority to "prescribe rules regarding registration requirements" for non-banks, which the Bureau also contends allows it to publish the data.[8] Dodd-Frank also authorizes the Bureau to use its general market monitoring authority to require information beyond what might be expected by a simple registration system.[9] Finally, the Bureau relies on its supervisory jurisdiction to impose the annual attestation requirement on supervised non-banks.[10]
The proposal has a 60-day public comment period. After that period, the Bureau will review the comments and determine whether to finalize the rule. The earliest likely final rule would be in late 2023. However, the Bureau stated it expects to delay compliance until at least January 2024, by which time it expects to have established an online registration system.
We think this proposal is significant because of its broad reach – it covers every non-bank provider – and because it could amplify the significance of state court matters by making them accessible to both the CFPB and the public. We expect the proposal to face vociferous objection from industry.
